tbeu / matio / #1079

83%

push

travis-ci

Bounds-check index in Mat_VarGetCellsLinear

Mat_VarGetCellsLinear indexes matvar->data based on dims without
checking against the actual allocation size (nbytes). A malformed
file where dims claims more elements than were actually read causes
an out-of-bounds read.

Compute the actual element count from nbytes and validate each
index before dereferencing.

As reportec by https://github.com/tbeu/matio/pull/303

4 of 6 new or added lines in 1 file covered. (66.67%)

13122 of 15805 relevant lines covered (83.02%)

53281.43 hits per line